Exploit emerges for DNS flaw

Exploit code has surfaced for a much-touted Domain Name System flaw..

Researchers HD Moore and Druid have developed a module which is capable of exploiting the vulnerability. The module runs through Metasploit, a vulnerability-testing framework built by Moore.

The exploit code is the first to appear for the DNS cache-poisoning flaw first discovered by researcher Dan Kaminsky.

The release of the module comes just days after details of the flaw were disclosed by fellow researcher Halvar Flake.

Kaminsky said that he had found the flaw, but refrained from disclosing the details until vendors could issue a patch. He planned to unveil the details at next month's Blackhat conference.

Though the details of the vulnerability were not publically available, Kaminsky shared his research with a number of hardware and software vendors, prompting one of the largest mass-patch rollouts in history.

That policy may have helped avoid a major catastrophe, as most servers were protected even before details on the flaw were publically known.

"My impression is that most of the major ISPs have already patched," said Ramzan.

"At this stage I don't know if it is going to affect end users."

Ramzan said that while there are a large number of server that have not been patched, many are poorly maintained servers and are likely to be open to older, more established attack methods anyways.

He also noted that though the module has the ability to exploit the flaw, it is far from a real-world attack by actual criminals.

However, administrators may not be out of the woods just yet. Ramzan said that a greater danger could come after Kaminsky posts the full details of the flaw and attackers get a better look at the nature of the vulnerability.

"There is a saying in the security community that attacks always get better, they never get worse," he explained.

"Someone might develop variations on the attack that are more potent in the future."

All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.Your use of this website
constitutes acceptance of nextmedia's Privacy Policy and
Terms & Conditions.